5 ms·

BeyondCorp (2014)

39 points by udev4096 2y ago

jwildeboer 2y ago
From 2014, so I guess posted as anniversary reminder?
zer0c00ler 2y ago
A lot of people wrongly believe this means no firewall. If you don't use firewalls (yes, even for web traffic and SaaS, limit who can access your stuff), you are doing something wrong.
- p_l 2y ago
  It means end of the classic BLACKER firewall/VPN model, however. No more "trusted" red network behind firewall/VPN gateway (aka "blacker") separating it from the untrusted black network. The metaphorical firewall is there on every endpoint.
gcr 2y ago
BeyondCorp is such a great idea! I wish it were easier to implement from other companies.
- parkerhiggins 2y ago
  It is and today, it’s relatively straight-forward to implement. Get a good Zero Trust vendor.
  - arccy 2y ago
    most companies are built on a random collection of SaaS services, you have to hope they all support it properly beyond just SSO
  - cpach 2y ago
    Any example?
    - fullspectrumdev 2y ago
      You can implement this kind of thing using tailscale quite easily. I will note though that “retrofitting” zero trust onto an existing network is a fucking nightmare no matter which way you go about it.
      - cpach 2y ago
        Yeah Tailscale is pretty awesome. Recently heard someone claiming it doesn’t qualify as true ZT, but for a mere mortal like me it would go a pretty long way.
    - nunez 2y ago
      Tailscale is fantastic at least for personal use.
  - jesseendahl 2y ago
    Most of the “Zero Trust” vendor solutions on the market are a joke compared to Google’s internal implementation (BeyondCorp). If you read through the journal papers Google published you’ll see just how much work it is to do zero trust properly.
ninkendo 2y ago
Am I crazy or is there nothing here? I see an abstract, a link to some unrelated search, “research areas” (another unrelated link) then a footer with a link to their team. Where do I actually read about beyondcorp?
- poidos 2y ago
  The page links here: https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp Seems like it has more information.
- kccqzy 2y ago
  Go to the linked PDF by clicking on Google Scholar: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec...
- almostgotcaught 2y ago
  > Am I crazy or is there nothing here? There's a journal ref right there under the name of the paper `;login:, Vol. 39, No. 6(2014), pp. 6-11`
  - ninkendo 2y ago
    What am I supposed to do with that?
    - almostgotcaught 2y ago
      > What am I supposed to do with that? my friend you're accessing this information (my comment and this link) on a device that is connected to the internet and you're upset that some resource doesn't spoon feed you (even though it does). > What am I supposed to do with that? here's a hint: the domain that this link is on is the name of a company that revolutionized information retrieval on the internet about 20 years ago. so much so that that same word (the name of the company) has become synonymous with information retrieval itself. so I suggest that what you're supposed to do with journal reference is put all these obvious factoids to good use and try to retrieve some information :)
Genbox 2y ago
Link to paper: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec...
input_sh 2y ago
(2014)
- gbin 2y ago
  Yep and this is what is impressive, I still haven't been in another company where either it was a security shit show (anything goes) or a profoundly stupid IT department removes root access for devs and put firewalls and do deep packet inspection, adds some whitelisting based on DNS rules so you cannot download anything... All that while showing all the certification letter soups and be very proud of their job.
  - nunez 2y ago
    Agree. Google did this back in 2015. It actually took me a long time to realize that the buzz around Zero Trust (which is still going strong today) is basically how Google did things when I was there. Not needing a VPN to access Google stuffs was great.
H8crilA 2y ago
[flagged]
- deleted 2y ago
  [deleted]
ofrzeta 2y ago
It's a bit strange to post this here without context. BeyondCorp is essentially the same as Zero Trust if I am not mistaken https://en.wikipedia.org/wiki/Zero_trust_security_model https://en.wikipedia.org/wiki/Zero_trust_security_model Open Source applications include: - https://landing.openziti.io/ https://landing.openziti.io/ - https://www.ory.sh/oathkeeper/ https://www.ory.sh/oathkeeper/ Any other important projects I am missing?
- p_l 2y ago
  BeyondCorp was, IIRC, originally the name for the internal platform that implemented Zero Trust security model, and after publication of paper on it popularised Zero Trust in the public. Both the open source projects you link derive their history partially from the BeyondCorp paper.
- dabber 2y ago
  > Any other important projects I am missing? Cloudflare Zero Trust: https://developers.cloudflare.com/cloudflare-one/ https://developers.cloudflare.com/cloudflare-one/
deleted 2y ago
[deleted]
dec0dedab0de 2y ago
When I was a network guy I used to argue more in favor of letting everything we could over the internet. it was cheaper than the various private circuits, and more reliable than VPNs. Then when I started programming I realized we can’t trust programmers to do anything safely. And I wanted to airgap everything, but ofcourse that’s ridiculous. So while we should assume all endpoints are open to the internet, I don’t think we should actually let them be. That would be madness. does anyone expect every printer and network managed light fixture to stay up to date and vulnerability free? Even if it does, do we trust the vendors to not start spying on their customers? I suspect this was mostly about selling the enterprise on saas/the cloud/google office. And it worked.
- p_l 2y ago
  No, this is more about removing the idea that there is any safe network. Don't assume internal network (or leased circuits or whatever) are secure. Make smallest possible security perimeters - on servers you design/deploy, that would be often the server or even specific applications. With devices you can't secure better (like printers etc.) make small islands that can talk only with appropriate gateway device. etc. etc.
deleted 2y ago
[deleted]
nunez 2y ago
Zero Trust before it became buzzword-ized!
aborsy 2y ago
Silly name, with common sense concepts!

BeyondCorp (2014)

39 points by udev4096 2y ago

From 2014, so I guess posted as anniversary reminder?

A lot of people wrongly believe this means no firewall. If you don't use firewalls (yes, even for web traffic and SaaS, limit who can access your stuff), you are doing something wrong.

p_l 2y ago
It means end of the classic BLACKER firewall/VPN model, however. No more "trusted" red network behind firewall/VPN gateway (aka "blacker") separating it from the untrusted black network. The metaphorical firewall is there on every endpoint.

gcr 2y ago

BeyondCorp is such a great idea! I wish it were easier to implement from other companies.

parkerhiggins 2y ago
It is and today, it’s relatively straight-forward to implement. Get a good Zero Trust vendor.
- arccy 2y ago
  most companies are built on a random collection of SaaS services, you have to hope they all support it properly beyond just SSO
- cpach 2y ago
  Any example?
  - fullspectrumdev 2y ago
    You can implement this kind of thing using tailscale quite easily. I will note though that “retrofitting” zero trust onto an existing network is a fucking nightmare no matter which way you go about it.
    - cpach 2y ago
      Yeah Tailscale is pretty awesome. Recently heard someone claiming it doesn’t qualify as true ZT, but for a mere mortal like me it would go a pretty long way.
  - nunez 2y ago
    Tailscale is fantastic at least for personal use.
- jesseendahl 2y ago
  Most of the “Zero Trust” vendor solutions on the market are a joke compared to Google’s internal implementation (BeyondCorp). If you read through the journal papers Google published you’ll see just how much work it is to do zero trust properly.

ninkendo 2y ago

Am I crazy or is there nothing here? I see an abstract, a link to some unrelated search, “research areas” (another unrelated link) then a footer with a link to their team. Where do I actually read about beyondcorp?

poidos 2y ago
The page links here: https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp Seems like it has more information.
kccqzy 2y ago
Go to the linked PDF by clicking on Google Scholar: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec...
almostgotcaught 2y ago
> Am I crazy or is there nothing here? There's a journal ref right there under the name of the paper `;login:, Vol. 39, No. 6(2014), pp. 6-11`
- ninkendo 2y ago
  What am I supposed to do with that?
  - almostgotcaught 2y ago
    > What am I supposed to do with that? my friend you're accessing this information (my comment and this link) on a device that is connected to the internet and you're upset that some resource doesn't spoon feed you (even though it does). > What am I supposed to do with that? here's a hint: the domain that this link is on is the name of a company that revolutionized information retrieval on the internet about 20 years ago. so much so that that same word (the name of the company) has become synonymous with information retrieval itself. so I suggest that what you're supposed to do with journal reference is put all these obvious factoids to good use and try to retrieve some information :)

Genbox 2y ago

Link to paper: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec...

input_sh 2y ago

(2014)

gbin 2y ago
Yep and this is what is impressive, I still haven't been in another company where either it was a security shit show (anything goes) or a profoundly stupid IT department removes root access for devs and put firewalls and do deep packet inspection, adds some whitelisting based on DNS rules so you cannot download anything... All that while showing all the certification letter soups and be very proud of their job.
- nunez 2y ago
  Agree. Google did this back in 2015. It actually took me a long time to realize that the buzz around Zero Trust (which is still going strong today) is basically how Google did things when I was there. Not needing a VPN to access Google stuffs was great.

H8crilA 2y ago

[flagged]

deleted 2y ago
[deleted]

ofrzeta 2y ago

It's a bit strange to post this here without context. BeyondCorp is essentially the same as Zero Trust if I am not mistaken https://en.wikipedia.org/wiki/Zero_trust_security_model https://en.wikipedia.org/wiki/Zero_trust_security_model Open Source applications include: - https://landing.openziti.io/ https://landing.openziti.io/ - https://www.ory.sh/oathkeeper/ https://www.ory.sh/oathkeeper/ Any other important projects I am missing?

p_l 2y ago
BeyondCorp was, IIRC, originally the name for the internal platform that implemented Zero Trust security model, and after publication of paper on it popularised Zero Trust in the public. Both the open source projects you link derive their history partially from the BeyondCorp paper.
dabber 2y ago
> Any other important projects I am missing? Cloudflare Zero Trust: https://developers.cloudflare.com/cloudflare-one/ https://developers.cloudflare.com/cloudflare-one/

deleted 2y ago

[deleted]

dec0dedab0de 2y ago

When I was a network guy I used to argue more in favor of letting everything we could over the internet. it was cheaper than the various private circuits, and more reliable than VPNs. Then when I started programming I realized we can’t trust programmers to do anything safely. And I wanted to airgap everything, but ofcourse that’s ridiculous. So while we should assume all endpoints are open to the internet, I don’t think we should actually let them be. That would be madness. does anyone expect every printer and network managed light fixture to stay up to date and vulnerability free? Even if it does, do we trust the vendors to not start spying on their customers? I suspect this was mostly about selling the enterprise on saas/the cloud/google office. And it worked.

p_l 2y ago
No, this is more about removing the idea that there is any safe network. Don't assume internal network (or leased circuits or whatever) are secure. Make smallest possible security perimeters - on servers you design/deploy, that would be often the server or even specific applications. With devices you can't secure better (like printers etc.) make small islands that can talk only with appropriate gateway device. etc. etc.

deleted 2y ago

[deleted]

nunez 2y ago

Zero Trust before it became buzzword-ized!

aborsy 2y ago

Silly name, with common sense concepts!